
Security News
Packagist Urges Immediate Composer Update After GitHub Actions Token Leak
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.
@nextcloud/l10n
Advanced tools
Nextcloud L10n helpers for apps and libraries.
npm i -S @nextcloud/l10n
Apps normally use the Nextcloud provided translation mechanism which allows to translate backend (PHP) strings together with the frontend. This can either be done using the Nextcloud Transifex automatization or translations can be done manually. See the localization docs for how to setup.
When using the Nextcloud translation system (manually or with automated Transifex) Nextcloud will automatically register the translations on the frontend. In this case all you have to do is to import the translation functions from this package like shown below:
import { t, n } from '@nextcloud/l10n'
// Or
import { translate as t, translatePlural as n } from '@nextcloud/l10n'
[!NOTE] In order to not break the l10n string extraction scripts, make sure to use the aliases
tandn.
t('myapp', 'Hello!')
t('myapp', 'Hello {name}!', { name: 'Jane' })
By default placeholders are sanitized and escaped to prevent XSS. But you can disable this behavior if you trust the user input:
t(
'myapp',
'See also the {linkStart}documentation{linkEnd}.',
{
linkStart: '<a href="http://example.com">'
linkEnd: '</a>',
},
undefined, // this would be a number replacement
{ escape: false },
)
n('myapp', '%n cloud', '%n clouds', 100)
Of course also placeholders are possible:
n('myapp', '{name} owns %n file', '{name} owns %n files', 100, { name: 'Jane' })
It is also possible to use this package for Nextcloud independent translations. This is mostly useful for libraries that provide translated strings.
Independent means you can use this without Nextcloud registered translations buy just providing your .po files.
If you decide to use this way you have to extract the translation strings manually, for example using the gettext-extractor.
import { getGettextBuilder } from '@nextcloud/l10n/gettext'
const po = ... // Use https://github.com/smhg/gettext-parser to read and convert your .po(t) file
// When using this for a Nextcloud app you can auto-detect the language
const gt = getGettextBuilder()
.detectLocale()
.addTranslation('sv', po)
.build()
// But it is also possible to force a language
const gt = getGettextBuilder()
.setLocale('sv')
.addTranslation('sv', po)
.build()
To make things easier you could also create aliases for this in a module and reuse it in your code:
// When using JavaScript
export const t = (...args) => gt.gettext(...args)
export const n = (...args) => gt.ngettext(...args)
// When using Typescript
export const t = (...args: Parameters<typeof gt.gettext>) => gt.gettext(...args)
export const n = (...args: Parameters<typeof gt.ngettext>) => gt.ngettext(...args)
gt.gettext('my source string')
// or if you are using the aliases mentioned above:
t('my source string')
gt.gettext('this is a {placeholder}. and this is {key2}', {
placeholder: 'test',
key2: 'also a test',
})
gt.ngettext('%n Mississippi', '%n Mississippi', 3)
// or if you are using the aliases mentioned above:
n('%n Mississippi', '%n Mississippi', 3)
main or stableXv4.0.1): git checkout -b v<version>npm version patch --no-git-tag-version (npm version minor --no-git-tag-version if minor).
This will return a new version name, make sure it matches what you expectgenerate then paste the content to the CHANGELOG.md file
npm run prerelease:format-changelog.
This will apply this regex: by @([^ ]+) in ((https://github.com/)nextcloud-libraries/nextcloud-l10n/pull/(\d+))
Which this as the replacement: [\#$4]($2) \([$1]($3$1)\)v4.0.1)
FAQs
Nextcloud localization and translation helpers for apps and libraries
The npm package @nextcloud/l10n receives a total of 17,486 weekly downloads. As such, @nextcloud/l10n popularity was classified as popular.
We found that @nextcloud/l10n demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.

Company News
Socket was named to the Rising in Cyber 2026 list, recognizing 30 private cybersecurity startups selected by CISOs and security executives.